411
Eskom’s Prepaid System Breach: A Major Financial Disaster as Internal Controls Fail

Eskom, South Africa’s beleaguered power utility, has found itself at the center of a massive financial scandal following a breach of its prepaid electricity system. According to the Auditor General of South Africa (AGSA), Eskom’s controls over its Online Vending System (OVS) were so weak that the extent of the breach, including the creation and sale of fraudulent prepaid electricity tokens, remains largely undetermined.
A Major Breach of Security
In December, Eskom revealed a shocking security lapse in its OVS, which is responsible for dispensing prepaid electricity through virtual channels like banking apps, ATMs, and vending stations. The system was compromised, allowing illicit operators, and potentially Eskom employees, to generate fraudulent electricity tokens. These tokens are encrypted and should only be valid if verified against Eskom’s central database. However, due to the breach, these controls were bypassed, leading to the circulation of unauthorized tokens.
Eskom suspects internal collusion, with staff members potentially involved in facilitating the illegal token sales. To address the issue, the utility commissioned an external IT firm to conduct a forensic investigation and identify ways to secure the system against future breaches.
AGSA Flags Internal Control Failures
The AGSA’s report has been damning, highlighting a significant breakdown of Eskom’s internal controls in relation to the prepaid electricity system. According to the AGSA’s audit, the breach represents one of the most serious financial failures identified in Eskom’s recent financial review. The auditors noted that Eskom’s controls were insufficient to prevent the fraud and to properly assess its financial impact.
Among the key deficiencies outlined were:
- Inappropriate user access controls allowing unauthorized use within the prepaid system.
- Outdated systems lacking essential data logs for tracking and auditing.
- Inadequate backup procedures, leaving critical data unprotected.
- A lack of understanding by Eskom staff regarding the prepaid IT ecosystem, including the hardware and systems involved.
These weaknesses contributed to Eskom’s inability to assess whether the breach had a material financial impact, especially since the tokens in circulation may carry future financial obligations.
The Financial Fallout
The true cost of the breach remains uncertain, but Eskom’s failure to quantify its financial impact is a serious concern. The OVS is a critical part of Eskom’s revenue generation, and any illicit tokens in circulation could result in significant losses. Additionally, Eskom has warned that the breach may worsen as the utility seeks to implement tariff hikes under its cost-reflective pricing strategy. These increases could exacerbate affordability challenges for many consumers, potentially driving further demand for illegal electricity connections and illicit tokens.
A Call for Improved Controls and Accountability
The AGSA’s findings have prompted urgent calls for Eskom to overhaul its internal controls and improve its monitoring and response systems. As Eskom continues to grapple with financial mismanagement, corruption, and system failures, it’s clear that serious reforms are needed to safeguard the utility’s operations and finances.
The Eskom prepaid system breach serves as a stark reminder of the vulnerabilities in South Africa’s critical infrastructure and the dire need for stronger internal controls. As Eskom works to rectify its security failures and address the ongoing financial fallout, the utility must also tackle broader governance issues to ensure that such incidents do not happen again. For now, the question remains: how much damage has been done, and how much more is still to be uncovered?
Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram
For more News in Johannesburg, visit joburgetc.com